1 //-----------------------------------------------------------------------------
2 // Miscellaneous routines for low frequency tag operations.
3 // Tags supported here so far are Texas Instruments (TI), HID
4 // Also routines for raw mode reading/simulating of LF waveform
6 //-----------------------------------------------------------------------------
9 #include "../common/crc16.c"
11 void AcquireRawAdcSamples125k(BOOL at134khz
)
14 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
15 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
17 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
18 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
21 // Connect the A/D to the peak-detected low-frequency path.
22 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
24 // Give it a bit of time for the resonant antenna to settle.
27 // Now set up the SSC to get the ADC samples that are now streaming at us.
30 // Now call the acquisition routine
31 DoAcquisition125k(at134khz
);
34 // split into two routines so we can avoid timing issues after sending commands //
35 void DoAcquisition125k(BOOL at134khz
)
37 BYTE
*dest
= (BYTE
*)BigBuf
;
38 int n
= sizeof(BigBuf
);
44 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
45 SSC_TRANSMIT_HOLDING
= 0x43;
48 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
49 dest
[i
] = (BYTE
)SSC_RECEIVE_HOLDING
;
57 DbpIntegers(dest
[0], dest
[1], at134khz
);
60 void ModThenAcquireRawAdcSamples125k(int delay_off
,int period_0
,int period_1
,BYTE
*command
)
64 // see if 'h' was specified
65 if(command
[strlen((char *) command
) - 1] == 'h')
71 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
72 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
74 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
75 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
78 // Give it a bit of time for the resonant antenna to settle.
81 // Now set up the SSC to get the ADC samples that are now streaming at us.
84 // now modulate the reader field
85 while(*command
!= '\0' && *command
!= ' ')
87 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
89 SpinDelayUs(delay_off
);
91 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
92 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
94 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
95 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
98 if(*(command
++) == '0')
99 SpinDelayUs(period_0
);
101 SpinDelayUs(period_1
);
103 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
105 SpinDelayUs(delay_off
);
107 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
108 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
110 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
111 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
115 DoAcquisition125k(at134khz
);
118 void AcquireTiType(void)
121 // tag transmission is <20ms, sampling at 2M gives us 40K samples max
122 // each sample is 1 bit stuffed into a DWORD so we need 1250 DWORDS
126 DbpIntegers((DWORD
)BigBuf
, sizeof(BigBuf
), 0x12345678);
127 memset(BigBuf
,0,sizeof(BigBuf
));
129 // Set up the synchronous serial port
130 PIO_DISABLE
= (1<<GPIO_SSC_DIN
);
131 PIO_PERIPHERAL_A_SEL
= (1<<GPIO_SSC_DIN
);
133 // steal this pin from the SSP and use it to control the modulation
134 PIO_ENABLE
= (1<<GPIO_SSC_DOUT
);
135 PIO_OUTPUT_ENABLE
= (1<<GPIO_SSC_DOUT
);
137 SSC_CONTROL
= SSC_CONTROL_RESET
;
138 SSC_CONTROL
= SSC_CONTROL_RX_ENABLE
| SSC_CONTROL_TX_ENABLE
;
140 // Sample at 2 Mbit/s, so TI tags are 16.2 vs. 14.9 clocks long
141 // 48/2 = 24 MHz clock must be divided by 12
142 SSC_CLOCK_DIVISOR
= 12;
144 SSC_RECEIVE_CLOCK_MODE
= SSC_CLOCK_MODE_SELECT(0);
145 SSC_RECEIVE_FRAME_MODE
= SSC_FRAME_MODE_BITS_IN_WORD(32) | SSC_FRAME_MODE_MSB_FIRST
;
146 SSC_TRANSMIT_CLOCK_MODE
= 0;
147 SSC_TRANSMIT_FRAME_MODE
= 0;
152 PIO_OUTPUT_DATA_SET
= (1<<GPIO_SSC_DOUT
);
154 // Charge TI tag for 50ms.
157 // stop modulating antenna and listen
158 PIO_OUTPUT_DATA_CLEAR
= (1<<GPIO_SSC_DOUT
);
164 if(SSC_STATUS
& SSC_STATUS_RX_READY
) {
165 BigBuf
[i
] = SSC_RECEIVE_HOLDING
; // store 32 bit values in buffer
166 i
++; if(i
>= n
) return;
171 // return stolen pin to SSP
172 PIO_DISABLE
= (1<<GPIO_SSC_DOUT
);
173 PIO_PERIPHERAL_A_SEL
= (1<<GPIO_SSC_DIN
) | (1<<GPIO_SSC_DOUT
);
180 void WriteTIbyte(BYTE b
)
184 // modulate 8 bits out to the antenna
188 // stop modulating antenna
189 PIO_OUTPUT_DATA_CLEAR
= (1<<GPIO_SSC_DOUT
);
192 PIO_OUTPUT_DATA_SET
= (1<<GPIO_SSC_DOUT
);
195 // stop modulating antenna
196 PIO_OUTPUT_DATA_CLEAR
= (1<<GPIO_SSC_DOUT
);
199 PIO_OUTPUT_DATA_SET
= (1<<GPIO_SSC_DOUT
);
205 void AcquireRawBitsTI(void)
207 // TI tags charge at 134.2Khz
208 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
210 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
211 // connects to SSP_DIN and the SSP_DOUT logic level controls
212 // whether we're modulating the antenna (high)
213 // or listening to the antenna (low)
214 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU
);
216 // get TI tag data into the buffer
219 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
222 // arguments: 64bit data split into 32bit idhi:idlo and optional 16bit crc
223 // if crc provided, it will be written with the data verbatim (even if bogus)
224 // if not provided a valid crc will be computed from the data and written.
225 void WriteTItag(DWORD idhi
, DWORD idlo
, WORD crc
)
228 // WARNING the order of the bytes in which we calc crc below needs checking
229 // i'm 99% sure the crc algorithm is correct, but it may need to eat the
230 // bytes in reverse or something
233 crc
= update_crc16(crc
, (idlo
)&0xff);
234 crc
= update_crc16(crc
, (idlo
>>8)&0xff);
235 crc
= update_crc16(crc
, (idlo
>>16)&0xff);
236 crc
= update_crc16(crc
, (idlo
>>24)&0xff);
237 crc
= update_crc16(crc
, (idhi
)&0xff);
238 crc
= update_crc16(crc
, (idhi
>>8)&0xff);
239 crc
= update_crc16(crc
, (idhi
>>16)&0xff);
240 crc
= update_crc16(crc
, (idhi
>>24)&0xff);
242 DbpString("Writing the following data to tag:");
243 DbpIntegers(idhi
, idlo
, crc
);
245 // TI tags charge at 134.2Khz
246 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 88); //134.8Khz
247 // Place FPGA in passthrough mode, in this mode the CROSS_LO line
248 // connects to SSP_DIN and the SSP_DOUT logic level controls
249 // whether we're modulating the antenna (high)
250 // or listening to the antenna (low)
251 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_PASSTHRU
);
254 // steal this pin from the SSP and use it to control the modulation
255 PIO_ENABLE
= (1<<GPIO_SSC_DOUT
);
256 PIO_OUTPUT_ENABLE
= (1<<GPIO_SSC_DOUT
);
258 // writing algorithm:
259 // a high bit consists of a field off for 1ms and field on for 1ms
260 // a low bit consists of a field off for 0.3ms and field on for 1.7ms
261 // initiate a charge time of 50ms (field on) then immediately start writing bits
262 // start by writing 0xBB (keyword) and 0xEB (password)
263 // then write 80 bits of data (or 64 bit data + 16 bit crc if you prefer)
264 // finally end with 0x0300 (write frame)
265 // all data is sent lsb firts
266 // finish with 15ms programming time
269 PIO_OUTPUT_DATA_SET
= (1<<GPIO_SSC_DOUT
);
270 SpinDelay(50); // charge time
272 WriteTIbyte(0xbb); // keyword
273 WriteTIbyte(0xeb); // password
274 WriteTIbyte( (idlo
)&0xff );
275 WriteTIbyte( (idlo
>>8 )&0xff );
276 WriteTIbyte( (idlo
>>16)&0xff );
277 WriteTIbyte( (idlo
>>24)&0xff );
278 WriteTIbyte( (idhi
)&0xff );
279 WriteTIbyte( (idhi
>>8 )&0xff );
280 WriteTIbyte( (idhi
>>16)&0xff );
281 WriteTIbyte( (idhi
>>24)&0xff ); // data hi to lo
282 WriteTIbyte( (crc
)&0xff ); // crc lo
283 WriteTIbyte( (crc
>>8 )&0xff ); // crc hi
284 WriteTIbyte(0x00); // write frame lo
285 WriteTIbyte(0x03); // write frame hi
286 PIO_OUTPUT_DATA_SET
= (1<<GPIO_SSC_DOUT
);
287 SpinDelay(50); // programming time
291 // get TI tag data into the buffer
294 FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF
);
295 DbpString("Now use tibits and tidemod");
298 void SimulateTagLowFrequency(int period
, int ledcontrol
)
301 BYTE
*tab
= (BYTE
*)BigBuf
;
303 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_SIMULATOR
);
305 PIO_ENABLE
= (1 << GPIO_SSC_DOUT
) | (1 << GPIO_SSC_CLK
);
307 PIO_OUTPUT_ENABLE
= (1 << GPIO_SSC_DOUT
);
308 PIO_OUTPUT_DISABLE
= (1 << GPIO_SSC_CLK
);
310 #define SHORT_COIL() LOW(GPIO_SSC_DOUT)
311 #define OPEN_COIL() HIGH(GPIO_SSC_DOUT)
315 while(!(PIO_PIN_DATA_STATUS
& (1<<GPIO_SSC_CLK
))) {
317 DbpString("Stopped");
334 while(PIO_PIN_DATA_STATUS
& (1<<GPIO_SSC_CLK
)) {
336 DbpString("Stopped");
343 if(i
== period
) i
= 0;
347 // compose fc/8 fc/10 waveform
348 static void fc(int c
, int *n
) {
349 BYTE
*dest
= (BYTE
*)BigBuf
;
352 // for when we want an fc8 pattern every 4 logical bits
363 // an fc/8 encoded bit is a bit pattern of 11000000 x6 = 48 samples
365 for (idx
=0; idx
<6; idx
++) {
377 // an fc/10 encoded bit is a bit pattern of 1110000000 x5 = 50 samples
379 for (idx
=0; idx
<5; idx
++) {
394 // prepare a waveform pattern in the buffer based on the ID given then
395 // simulate a HID tag until the button is pressed
396 void CmdHIDsimTAG(int hi
, int lo
, int ledcontrol
)
400 HID tag bitstream format
401 The tag contains a 44bit unique code. This is sent out MSB first in sets of 4 bits
402 A 1 bit is represented as 6 fc8 and 5 fc10 patterns
403 A 0 bit is represented as 5 fc10 and 6 fc8 patterns
404 A fc8 is inserted before every 4 bits
405 A special start of frame pattern is used consisting a0b0 where a and b are neither 0
406 nor 1 bits, they are special patterns (a = set of 12 fc8 and b = set of 10 fc10)
410 DbpString("Tags can only have 44 bits.");
414 // special start of frame marker containing invalid bit sequences
415 fc(8, &n
); fc(8, &n
); // invalid
416 fc(8, &n
); fc(10, &n
); // logical 0
417 fc(10, &n
); fc(10, &n
); // invalid
418 fc(8, &n
); fc(10, &n
); // logical 0
421 // manchester encode bits 43 to 32
422 for (i
=11; i
>=0; i
--) {
423 if ((i
%4)==3) fc(0,&n
);
425 fc(10, &n
); fc(8, &n
); // low-high transition
427 fc(8, &n
); fc(10, &n
); // high-low transition
432 // manchester encode bits 31 to 0
433 for (i
=31; i
>=0; i
--) {
434 if ((i
%4)==3) fc(0,&n
);
436 fc(10, &n
); fc(8, &n
); // low-high transition
438 fc(8, &n
); fc(10, &n
); // high-low transition
444 SimulateTagLowFrequency(n
, ledcontrol
);
451 // loop to capture raw HID waveform then FSK demodulate the TAG ID from it
452 void CmdHIDdemodFSK(int findone
, int *high
, int *low
, int ledcontrol
)
454 BYTE
*dest
= (BYTE
*)BigBuf
;
455 int m
=0, n
=0, i
=0, idx
=0, found
=0, lastval
=0;
458 FpgaSendCommand(FPGA_CMD_SET_DIVISOR
, 95); //125Khz
459 FpgaWriteConfWord(FPGA_MAJOR_MODE_LF_READER
);
461 // Connect the A/D to the peak-detected low-frequency path.
462 SetAdcMuxFor(GPIO_MUXSEL_LOPKD
);
464 // Give it a bit of time for the resonant antenna to settle.
467 // Now set up the SSC to get the ADC samples that are now streaming at us.
475 DbpString("Stopped");
485 if(SSC_STATUS
& (SSC_STATUS_TX_READY
)) {
486 SSC_TRANSMIT_HOLDING
= 0x43;
490 if(SSC_STATUS
& (SSC_STATUS_RX_READY
)) {
491 dest
[i
] = (BYTE
)SSC_RECEIVE_HOLDING
;
492 // we don't care about actual value, only if it's more or less than a
493 // threshold essentially we capture zero crossings for later analysis
494 if(dest
[i
] < 127) dest
[i
] = 0; else dest
[i
] = 1;
506 // sync to first lo-hi transition
507 for( idx
=1; idx
<m
; idx
++) {
508 if (dest
[idx
-1]<dest
[idx
])
514 // count cycles between consecutive lo-hi transitions, there should be either 8 (fc/8)
515 // or 10 (fc/10) cycles but in practice due to noise etc we may end up with with anywhere
516 // between 7 to 11 cycles so fuzz it by treat anything <9 as 8 and anything else as 10
517 for( i
=0; idx
<m
; idx
++) {
518 if (dest
[idx
-1]<dest
[idx
]) {
533 // we now have a set of cycle counts, loop over previous results and aggregate data into bit patterns
538 for( idx
=0; idx
<m
; idx
++) {
539 if (dest
[idx
]==lastval
) {
542 // a bit time is five fc/10 or six fc/8 cycles so figure out how many bits a pattern width represents,
543 // an extra fc/8 pattern preceeds every 4 bits (about 200 cycles) just to complicate things but it gets
544 // swallowed up by rounding
545 // expected results are 1 or 2 bits, any more and it's an invalid manchester encoding
546 // special start of frame markers use invalid manchester states (no transitions) by using sequences
549 n
=(n
+1)/6; // fc/8 in sets of 6
551 n
=(n
+1)/5; // fc/10 in sets of 5
553 switch (n
) { // stuff appropriate bits in buffer
556 dest
[i
++]=dest
[idx
-1];
559 dest
[i
++]=dest
[idx
-1];
560 dest
[i
++]=dest
[idx
-1];
562 case 3: // 3 bit start of frame markers
563 dest
[i
++]=dest
[idx
-1];
564 dest
[i
++]=dest
[idx
-1];
565 dest
[i
++]=dest
[idx
-1];
567 // When a logic 0 is immediately followed by the start of the next transmisson
568 // (special pattern) a pattern of 4 bit duration lengths is created.
570 dest
[i
++]=dest
[idx
-1];
571 dest
[i
++]=dest
[idx
-1];
572 dest
[i
++]=dest
[idx
-1];
573 dest
[i
++]=dest
[idx
-1];
575 default: // this shouldn't happen, don't stuff any bits
585 // final loop, go over previously decoded manchester data and decode into usable tag ID
586 // 111000 bit pattern represent start of frame, 01 pattern represents a 1 and 10 represents a 0
587 for( idx
=0; idx
<m
-6; idx
++) {
588 // search for a start of frame marker
589 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
593 if (found
&& (hi
|lo
)) {
595 DbpIntegers(hi
, lo
, (lo
>>1)&0xffff);
596 /* if we're only looking for one tag */
609 if (dest
[idx
] && (!dest
[idx
+1]) ) {
612 } else if ( (!dest
[idx
]) && dest
[idx
+1]) {
622 if ( dest
[idx
] && dest
[idx
+1] && dest
[idx
+2] && (!dest
[idx
+3]) && (!dest
[idx
+4]) && (!dest
[idx
+5]) )
626 if (found
&& (hi
|lo
)) {
628 DbpIntegers(hi
, lo
, (lo
>>1)&0xffff);
629 /* if we're only looking for one tag */